{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000013232231,
        "rte": "az",
        "prob": 0.000013232231
      },
      {
        "cls": 0,
        "raw": 0.00008533398,
        "rte": "az/scripts",
        "prob": 0.00008533398
      },
      {
        "cls": 0,
        "raw": 0.00026380023,
        "rte": "az/batch",
        "prob": 0.00026380023
      }
    ],
    "prob": 0.000013232231,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013232231140136719,
        "type": "batch"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-27T03:23:15Z"
  },
  "path": "Trojan.BAT.FormatA.b",
  "raw": {
    "v": "8",
    "rev": "c1ea9",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "w]zZbvrrS2iV{7}atm\u003cWfjx0Bz//MiBn",
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "mol": "H(F)Md",
        "sha": "58812eee316f0e65a61f43cbe0c77bd90bfb60b92be3d3fd88eb6b819131e4b0",
        "path": "/data/samples/bad/datasets/vxheaven/bat/trojan/Trojan.BAT.FormatA.b",
        "risk": 2,
        "size": 25,
        "type": "batch",
        "facts": {
          "imp": [
            [
              "",
              "format"
            ]
          ],
          "tgt": [
            "format"
          ],
          "metrics": {
            "ast": {
              "max_depth": 3,
              "call_count": 1,
              "node_count": 8
            },
            "file": {
              "size": 25,
              "entropy": 3.46
            },
            "text": {
              "lines": 1,
              "top_char": 116,
              "max_ws_run": 1,
              "space_count": 4,
              "char_entropy": 3.46,
              "unique_chars": 13,
              "top_char_null": 0,
              "top_char_ratio": 0.16,
              "avg_line_length": 25,
              "max_line_length": 25,
              "last_line_length": 25,
              "whitespace_ratio": 0.16,
              "identifier_density": 1
            },
            "binary": {
              "peak_region_bytes": 25,
              "peak_region_entropy": 3.46
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.script_as_unknown": 1
            },
            "identifiers": {
              "count": 1,
              "unique": 1,
              "avg_length": 6,
              "max_length": 6,
              "min_length": 6,
              "avg_entropy": 2.58,
              "reuse_ratio": 1,
              "all_lowercase_ratio": 1
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/extension/mismatch::batch-content-extension-mismatch",
            "conf": 0.9,
            "crit": 3,
            "desc": "Batch content mismatches filename extension"
          },
          {
            "id": "micro-behaviors/fs/volume/admin::batch-format-drive",
            "conf": 0.94,
            "crit": 3,
            "desc": "Batch formats a drive letter",
            "spans": [
              [
                0,
                9
              ]
            ]
          }
        ]
      }
    ]
  }
}